I'm running an Ubuntu 16.04 server with eCryptfs and samba.
User bob has created an encrypted private folder via
ecryptfs-setup-private. The wrapping passphrase matches the linux login passphrase. When bob connects via SSH, his private folder is decrypted automatically.
User bob has samba access to his home directory. The samba credentials match the linux login credentials.
The PAM configuration contains the default entries (created by Ubuntu and eCryptfs).
/etc/fstab contains no entries specific to eCryptfs.
When bob accesses his private folder via samba from a Windows client, his private folder is not decrypted. The samba server log (
Signature not found in user keyring Perhaps try the interactive 'ecryptfs-mount-private'
The same message occurs when bob opens a shell via
sudo; it does not occur when bob opens a shell via
su. Apparently, the user session keyring has different content depending on login method:
$ su -c 'keyctl show @s' bob Keyring 887339582 --alswrv 1000 65534 keyring: _uid_ses.1000 797923857 --alswrv 1000 65534 \_ keyring: _uid.1000 523913245 --alswrv 1000 1000 \_ user: 363f394f32249cc4 840141489 --alswrv 1000 1000 \_ user: 905f555cf7fd10e0 $ sudo -i -H -u bob -- keyctl show @s Signature not found in user keyring Perhaps try the interactive 'ecryptfs-mount-private' Keyring 887339582 --alswrv 1000 65534 keyring: _uid_ses.1000 797923857 --alswrv 1000 65534 \_ keyring: _uid.1000
It seems that the login credentials are missing in the keyring when using
I suppose that when I find a solution for the
sudo case, it can be applied to the samba problem.
I tried changing
/etc/pam.d/sudo to the contents of
/etc/pam.d/su, but it had no effect. I've read about
pam_cifscreds, but don't know if and how one of these could be helpful here. I've browsed through the wikis of ubuntuusers.de and Arch Linux, found several questions on StackOverflow and unix.stackexchange.com (references are omitted due to low reputation), but did not find a solution yet.
- What is necessary for eCryptfs to use the login credentials in the
- What is necessary for eCryptfs to use the login credentials in the samba case?